No state in response when doing readSigninResponseState

[jamalavedra]

Hi,

when doing a silent signing, the callback always expects that there is a custom state url_state. This is required because: SigninResponse.ts:

const splitState = decodeURIComponent(this.state).split(URL_STATE_DELIMITER);
this.state = splitState[0];

And then at the callback it throws readSigninResponseState: Error: No state in response from the readSigninResponseState function from OidcClient.ts. This happens because when url_state is provided:

SigninRequest.ts

        if (url_state) {
            stateParam = `${stateParam}${URL_STATE_DELIMITER}${url_state}`;
        }

but url_state is optional.

[pamapa]

I do not understand what you mean:

SigninResponse.ts is protected by a if (this.state): https://github.com/authts/oidc-client-ts/blob/3d403d93d05188bec7e98f224d4ca0ab27d4ad8b/src/SigninResponse.ts#L55-L61

SigninRequest.ts is protected by a if if (url_state): https://github.com/authts/oidc-client-ts/blob/3d403d93d05188bec7e98f224d4ca0ab27d4ad8b/src/SigninRequest.ts#L133-L135

[jamalavedra]

but when if (this.state) is true, then at https://github.com/authts/oidc-client-ts/blob/3d403d93d05188bec7e98f224d4ca0ab27d4ad8b/src/OidcClient.ts#L159 it will throw an error of No state in response. The state is indeed present because its properly prepared when creating the siginRequest, but if im not using a the url_state then the this.state = splitState[0] will be undefined which will make the condition above throw.

[pamapa]

it will throw an error of No state in response. The state is indeed present because its properly prepared when creating the siginRequest, but if i'm not using a the url_state then the this.state = splitState[0] will be undefined which will make the condition above throw.

url_state is optional. You always have a state. This state is required to match the original request. See https://github.com/authts/oidc-client-ts/blob/1d39fe7823a415ed2a68b2982abc11d6dde91af7/src/SigninRequest.ts#L155-L158